svchost.exe & update.exe

显示全部楼层 · 发表于 2011-10-1 03:41:53

eset kill all

显示全部楼层 · 发表于 2011-10-1 04:24:06

金山报毒

显示全部楼层 · 发表于 2011-10-1 07:02:10

mb kill1x

显示全部楼层 · 发表于 2011-10-1 07:47:44

BitDefender
svchost.exe Gen:Variant.Kazy.38907
update.exe GenPack:Trojan.Generic.6460702

显示全部楼层 · 发表于 2011-10-1 07:49:13

卡巴对象感染以下病毒： Backdoor.Win32.Agent.bulo

显示全部楼层 · 发表于 2011-10-1 08:34:20

2011-10-1 8:31:45 C:\Documents and Settings\Administrator\桌面\svchost.exe 直接访问磁盘 \\.\Harddisk0\DR0 已阻止 018.Direct access to disk

2011-10-1 8:31:44 C:\Documents and Settings\Administrator\桌面\svchost.exe 直接访问磁盘 \\.\Harddisk0\DR0 已阻止 018.Direct access to disk

2011-10-1 8:31:43 C:\Documents and Settings\Administrator\桌面\svchost.exe 直接访问磁盘 \\.\Harddisk0\DR0 已阻止 018.Direct access to disk

2011-10-1 8:31:43 C:\WINDOWS\system32\reg.exe 修改注册表 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\桌面\svchost.exe 已阻止 038.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\*

2011-10-1 8:31:43 C:\WINDOWS\system32\reg.exe 修改注册表 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions 已阻止 038.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions

2011-10-1 8:31:43 C:\WINDOWS\system32\reg.exe 修改注册表 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions 已阻止 038.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions

2011-10-1 8:31:43 C:\WINDOWS\system32\cmd.exe 启动新应用程序 C:\WINDOWS\system32\reg.exe 已允许 008.%windir%\system32\cmd.exe>%windir%\system32\reg.exe

2011-10-1 8:31:43 C:\WINDOWS\system32\cmd.exe 启动新应用程序 C:\WINDOWS\system32\reg.exe 已允许 008.%windir%\system32\cmd.exe>%windir%\system32\reg.exe

2011-10-1 8:31:43 C:\WINDOWS\system32\cmd.exe 启动新应用程序 C:\WINDOWS\system32\reg.exe 已允许 008.%windir%\system32\cmd.exe>%windir%\system32\reg.exe

2011-10-1 8:31:42 C:\WINDOWS\system32\cmd.exe 启动新应用程序 C:\WINDOWS\system32\reg.exe 已允许 008.%windir%\system32\cmd.exe>%windir%\system32\reg.exe

2011-10-1 8:31:42 C:\Documents and Settings\Administrator\桌面\svchost.exe 直接访问磁盘 \\.\Harddisk0\DR0 已阻止 018.Direct access to disk

2011-10-1 8:31:41 C:\Documents and Settings\Administrator\桌面\svchost.exe 修改其他应用程序的状态 C:\Documents and Settings\Administrator\桌面\svchost.exe 已允许 018.Modifying other processes & Loading Drivers

显示全部楼层 · 发表于 2011-10-1 08:36:56

2011-10-1 8:34:08 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改其他应用程序的状态 C:\WINDOWS\system32\taskmgr.exe 已阻止 002.%windir%\system32\taskmgr.exe

2011-10-1 8:34:04 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改启动设置 HKEY_USERS\S-1-5-21-790525478-1343024091-303738163-500\Software\Microsoft\Windows\CurrentVersion\Run\winupdater 已阻止 040.Autoruns

2011-10-1 8:34:03 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改启动设置 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start 已阻止 040.Autoruns

2011-10-1 8:34:02 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改注册表 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify 已阻止 038.HKEY_LOCAL_MACHINE\Software\Microsoft\Security center*

2011-10-1 8:34:02 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改注册表 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify 已阻止 038.HKEY_LOCAL_MACHINE\Software\Microsoft\Security center*

2011-10-1 8:34:02 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改注册表 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications 已阻止 040.HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\SharedAccess*

2011-10-1 8:34:02 C:\WINDOWS\system32\Windupdt\winupdate.exe 修改注册表 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall 已阻止 038.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall

2011-10-1 8:34:02 C:\Documents and Settings\Administrator\桌面\update.exe 修改注册表 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop 已阻止 038.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\

2011-10-1 8:34:02 C:\Documents and Settings\Administrator\桌面\update.exe 修改注册表 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents 已阻止 038.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\

2011-10-1 8:34:01 C:\Documents and Settings\Administrator\桌面\update.exe 修改注册表 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit 已阻止 038.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*

2011-10-1 8:34:00 C:\Documents and Settings\Administrator\桌面\update.exe 修改启动设置 HKEY_USERS\S-1-5-21-790525478-1343024091-303738163-500\Software\Microsoft\Windows\CurrentVersion\Run\winupdater 已阻止 040.Autoruns

显示全部楼层 · 发表于 2011-10-1 09:27:15

360

扫描结果
======================
病毒扫描结果
----------------------
D:\DOWNLOAD\TDDOWNLOAD.zip=>update.exe 后门木马(Win32/Backdoor.50a) 已删除
D:\DOWNLOAD\TDDOWNLOAD.zip=>svchost.exe HEUR/Malware.QVM03.Gen 已删除

显示全部楼层 · 发表于 2011-10-1 10:42:35

kis kill

[病毒样本] svchost.exe & update.exe

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块